UNODC ¦ An Interconnected Criminal Ecosystem: TOCTA for South-East Asia 2026

One criminal economy, many revenue streams

South-East Asia is not dealing with separate criminal markets that happen to overlap from time to time. The latest UNODC Transnational Organized Crime Threat Assessment (TOCTA), together with recent enforcement material, points to a single connected criminal ecosystem built around drugs, cyber fraud, illegal gambling, trafficking in persons, online child sexual exploitation (OCSE), illicit trade, firearms, waste crime, and money laundering. These crimes share the same people, the same infrastructure, and often the same payment channels.

A suspicious account, wallet, or company may not make sense if viewed alone. But when placed inside a wider pattern of scam proceeds, gambling settlements, mule accounts, offshore conversion, and layered corporate structures, the picture becomes much clearer. Criminal groups are increasingly operating like service businesses. They buy, sell, rent, and reuse the tools of crime.

That is why the threat is harder to disrupt. When one route or platform is hit, another is ready to take its place.

Drugs, fraud, and gambling are now financially linked

The region’s drug markets remain huge and they are part of a broader financial system. Ketamine seizures in East and South-East Asia reached a record 52.5 tons in 2025, with South-East Asia accounting for roughly 46.2 tons. Heroin remains active, opium production in Myanmar has risen sharply, and cocaine and cannabis are moving through new maritime and air routes. None of this exists in isolation from financial crime. The same brokers, payment handlers, and laundering channels used for drug trafficking can also be used for scam proceeds and gambling turnover.

Illegal online gambling is especially important here. It is not just a gaming or regulatory issue. It has become a financial backbone for organized crime. Operators use local bank transfers, e-wallets, peer-to-peer exchanges, cash agents, and stablecoins to move funds quickly and avoid detection. Deposit and withdrawal cycles are structured to stay below reporting thresholds, while settlement often moves through mule accounts into crypto or offshore wallets.

Gambling platforms do not just process bets. They process criminal money. In many cases, they also help clean it.

Bastian Schwind-Wagner _Follow

"South-East Asia’s criminal economy is tightly connected across drugs, scams, illegal gambling, trafficking, firearms, and money laundering. Criminal groups are using the same people, platforms, and payment channels across multiple markets, which makes the threat more resilient and harder to stop.

For anti-financial crime teams, the key lesson is to look for patterns across networks, not just single transactions. Stablecoins, mule accounts, guarantee marketplaces, and cross-border cash-out routes are central to how these groups move money and hide it."

Stablecoins are changing the laundering playbook

One of the clearest developments in the region is the use of stablecoins, especially USDT on TRON, as a preferred settlement rail. Criminals like them because they are fast, cheap, and widely accepted. For illicit networks, they solve a practical problem: how to move money across borders without relying on the traditional banking system.

This is not limited to gambling. Stablecoins sit at the center of fraud, trafficking, and laundering flows. Funds can move from a victim account into a consolidation wallet, then through multiple layers, and finally into exchanges, OTC brokers, or cash-out points. The speed is the point. It shortens the window for intervention and creates a trail that is hard to unwind if firms are only monitoring single accounts instead of networks.

Transaction monitoring needs to catch clustered wallet behavior, repeated micro-transactions, and settlement patterns tied to gambling, fraud, and high-risk marketplaces. The old model of looking for one large suspicious transfer is not enough.

Scam compounds are operational hubs for fraud and exploitation

The scam compound economy has become one of the region’s most disturbing criminal developments. Victims are recruited through fake job ads on social media and other platforms. They are promised customer service work, translation jobs, or high salaries. Then they are moved across borders into compounds in Myanmar, Cambodia, and Lao PDR, where passports are seized and coercion begins.

Inside these compounds, people are forced to run romance scams, crypto investment fraud, illegal gambling operations, and, in some cases, sexual exploitation schemes. This is not just trafficking in persons. It is forced criminality on an industrial scale. The revenue streams are multiple, and the financial flows overlap with those of gambling and digital fraud.

That overlap matters for financial institutions. A victim account, a mule account, and a payout account can all sit inside the same structure. In many cases, the same network also uses shell companies, crypto conversion services, and rented domestic bank accounts. The result is a highly adaptable laundering environment that can move between banking, crypto, and cash with very little friction.

Criminal marketplaces are turning crime into a service

One of the most important trends in the region is the growth of guarantee marketplaces and similar criminal service platforms. These are not just sales channels. They are service hubs where criminals can buy access to mule accounts, stolen data, payment support, software tools, hosting, and money laundering assistance.

This changes the economics of crime. A fraud group no longer needs to build every capability itself. It can outsource the parts it needs. The same marketplace can support scam operators, illegal gambling vendors, and laundering specialists. In practice, that means one platform can sustain several criminal markets at once.

For banks, fintechs, and payment providers, this should be a major warning sign. A suspicious merchant account may be tied to gambling, but the same network may also support fraud proceeds or trafficking-related payments. A suspicious wallet may sit inside a larger market that sells more than one type of criminal service. The challenge is not just identifying the account. It is identifying the ecosystem around it.

OCSEA and CSAM are part of the same financial problem

Online child sexual exploitation and abuse is often treated as a separate policy area, but the financial side tells a different story. The TOCTA shows how child sexual abuse material (CSAM) distribution can be monetized through subscription models, bots, cryptocurrency payments, and multi-hop redirect chains. In some cases, the same financial infrastructure used for fraud and gambling is also used for this abuse.

That means content enforcement alone is not enough. Takedowns need to be paired with tracing of payment flows, wallet clusters, and the administrators who monetize the material. The move toward AI-generated CSAM and deepfake abuse makes this even more urgent. It increases volume, lowers production costs, and creates new ways to extort victims.

For financial crime teams, this is not a niche issue. It is another example of how crime markets share the same rails.

Environmental crime also leaves financial footprints

The environmental crime section of the assessment may seem far removed from financial crime at first glance, but it should not be. Waste trafficking, illegal timber trade, wildlife trafficking, and critical mineral extraction all generate payments, invoices, trade finance flows, and shell company structures that can be monitored.

Waste crime is especially relevant. South-East Asia has become a major destination for trafficked waste after China’s import restrictions changed global waste flows. Criminals misdeclare hazardous waste as recyclable material, route it through transit countries, and use legitimate recycling businesses as cover. The financial side often includes false invoicing, over- or under-valued shipments, and offshore structures used to move proceeds.

The same is true for wildlife trafficking and timber. Online trade, encrypted communication, and crypto payments sit alongside physical smuggling. These are financial crime problems as much as environmental ones.

Firearms add the coercive layer

Illicit firearms trafficking is another important enabler. Weapons increase the coercive power of criminal groups, especially in scam compounds, smuggling networks, and cross-border trafficking routes. The report shows growing use of converted weapons, craft-made firearms, and even 3D-printed arms. Firearms are being advertised online, paid for with crypto, and moved through legitimate courier and transport systems.

From a financial crime perspective, firearms matter because they strengthen criminal control over cash-generating operations. They help protect trafficking routes, enforce discipline inside compounds, and raise the cost of intervention. That means firearms trafficking should be considered part of the wider risk picture when assessing criminal networks, especially those linked to fraud and forced labor.

What banks and AFC teams should take from this

The biggest lesson is that criminal typologies can no longer be treated in silos. Fraud, gambling, trafficking, drugs, child sexual exploitation, environmental crime, and firearms are interconnected through shared logistics, shared people, and shared financial rails.

That means a suspicious customer profile may not be best understood by looking only at that customer. It may be part of a multi-layered structure involving rented accounts, crypto settlement, gaming-related merchant activity, unusual IP behavior (internet activity that does not match the normal pattern expected from a user or account), guarantee marketplaces, or links to high-risk border regions. The real risk often sits in the network.

AFC teams should focus more on repeated patterns than on isolated alerts. Clusters of wallets, rapid deposit and withdrawal cycles, multiple accounts linked to the same device or IP range, and counterparties connected to online gambling or scam platforms deserve closer scrutiny. So do businesses with high turnover, thin operating histories, and payments flowing through several jurisdictions at speed.

The same applies to trade finance. Unrealistic shipment values, suspicious transshipment routes, inconsistent documentation, and activity involving waste, timber, or minerals should all trigger deeper review. Criminals are increasingly using legitimate commerce to disguise illicit flows.

A system built for adaptation

South-East Asia has become a strategic hub for organized crime because it offers geography (i.e., long coastlines, many islands, porous land borders, and proximity to major markets), weak governance gaps, digital connectivity, and financial flexibility. Criminal groups are not just exploiting weaknesses. They are building businesses around them.

For financial crime prevention, that means the target is not only a suspicious transaction. It is the system that makes that transaction possible.

Dive deeper

• UNODC ¦ New UNODC report reveals scale of South-East Asia’s ever more interconnected criminal economy ¦ Link